https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:11:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322086 EUVD-2026-322086 https://cve.radiocsirt.org/vuln/euvd-2026-322086 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42184 <p>Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri&#39;s is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://&lt;scheme&gt;.localhost/ because those platforms&#39; WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri&#39;s check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.</p> <p>Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri&#39;s is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://&lt;scheme&gt;.localhost/ because those platforms&#39; WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri&#39;s check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42184 https://cve.radiocsirt.org/vuln/ghsa-7gmj-67g7-phm9 <p><strong>Affected:</strong> crates.io: tauri</p> <p>### Summary A flaw in Tauri&#39;s `is_local_url()` function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to `http://&lt;scheme&gt;.localhost/` because those platforms&#39; WebView implementations cannot serve custom URI schemes directly.</p> <p>The issue is that Tauri&#39;s check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application (e.g. http://app.attacker.com/).&#34;</p> <p>Example: - Local URL: `app://localhost/` → on Android/Windows: `http://app.localhost/` - The check passes for any URL starting with `http://app.`, including `http://app.evil.com/`</p> <p>As a result, the attacker page can invoke backend commands that the developer intended to be accessible only to the app&#39;s own frontend and that are explicitly restricted from being called by external or remote origins.</p> <p>### Details Vulnerable function:</p> <p>```rust #[cfg(any(windows, target_os = &#34;android&#34;))] let local = { let protocol_url = self.manager().tauri_protocol_url(uses_https); let maybe_protocol = current_url .domain() .and_then(|d| d.split_once(&#39;.&#39;)) // BUG: only splits on first dot .unwrap_or_default() .0;</p> <p>protocols.contains_key(maybe_protocol) &amp;&amp; scheme == protocol_url.scheme() }; ```</p> <p>Link: https://github.com/tauri-apps/tauri/blob/1ef6a119b1571d1da0acc08bdb7fd5521a4c6d52/crates/tauri…</p> <p><strong>Affected:</strong> crates.io: tauri</p> <p>### Summary A flaw in Tauri&#39;s `is_local_url()` function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to `http://&lt;scheme&gt;.localhost/` because those platforms&#39; WebView implementations cannot serve custom URI schemes directly.</p> <p>The issue is that Tauri&#39;s check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application (e.g. http://app.attacker.com/).&#34;</p> <p>Example: - Local URL: `app://localhost/` → on Android/Windows: `http://app.localhost/` - The check passes for any URL starting with `http://app.`, including `http://app.evil.com/`</p> <p>As a result, the attacker page can invoke backend commands that the developer intended to be accessible only to the app&#39;s own frontend and that are explicitly restricted from being called by external or remote origins.</p> <p>### Details Vulnerable function:</p> <p>```rust #[cfg(any(windows, target_os = &#34;android&#34;))] let local = { let protocol_url = self.manager().tauri_protocol_url(uses_https); let maybe_protocol = current_url .domain() .and_then(|d| d.split_once(&#39;.&#39;)) // BUG: only splits on first dot .unwrap_or_default() .0;</p> <p>protocols.contains_key(maybe_protocol) &amp;&amp; scheme == protocol_url.scheme() }; ```</p> <p>Link: https://github.com/tauri-apps/tauri/blob/1ef6a119b1571d1da0acc08bdb7fd5521a4c6d52/crates/tauri…</p> https://cve.radiocsirt.org/vuln/ghsa-7gmj-67g7-phm9